proofbundle 3.6.0__tar.gz → 3.6.1__tar.gz

proofbundle-3.6.1/MANIFEST.in

@@ -0,0 +1,39 @@
+# PB-2026-0717-02: the published sdist shipped tests/ WITHOUT their runtime assets (fixtures, schemas,
+# examples, conformance corpus, formal-model results, the scripts the tests invoke) → the full sdist
+# pytest aborted with collection errors. This allowlist grafts exactly the assets the shipped tests need
+# to COLLECT AND RUN.
+#
+# Self-testable, honestly (PKG-2026-0718-01 / RE-GATE): `pip install <sdist> && pytest` runs the
+# package-level suite green. A documented subset of tests assert facts about the REPO/CI/Rust/docs LAYOUT
+# (`.github/workflows` contents, the Rust verifier source under `tools/`, `SPEC.md`/`CITATION.cff`, audit
+# records) — material this allowlist DELIBERATELY prunes (not a Python-package artifact). Those repo-context
+# tests SKIP outside a git checkout (tests/conftest.py::_REPO_CONTEXT_TESTS) rather than fail, so a
+# from-sdist run is clean — the honest form of "self-testable" (package tests run; repo-layout tests declare
+# themselves N/A).
+#
+# Per-directory allowlist (Befund C: not `package-data` — that targets the wheel/import package; the
+# sdist is the right vehicle for top-level tests/ + their assets). Large / non-Python-sdist material is
+# pruned: `tools/` is the Rust verifier + its 138M build tree (Rust runs from a git checkout with a
+# toolchain, never from the Python sdist — a category error to ship it), and build/CI-meta is excluded.
+# The shipped-example policy tests/test_renewal_policy.py loads is included by exact path (PKG-2026-0718-02)
+# — NOT `graft docs/adr`, which would also ship the ADR markdowns whose internal links reference pruned
+# repo files (breaking test_docs_truth from the sdist).
+graft tests
+graft schemas
+graft examples
+graft conformance
+graft formal
+graft docs/readiness_pack
+include docs/adr/renewal_policy.example.json
+graft scripts
+
+# Never ship: the Rust verifier + build artifacts, repo/CI meta, caches, VCS, big review packs.
+prune tools
+prune audit_artifacts
+prune .github
+prune target
+global-exclude __pycache__
+global-exclude *.py[cod]
+global-exclude *.so
+global-exclude *.rs
+global-exclude *.orig

{proofbundle-3.6.0/src/proofbundle.egg-info → proofbundle-3.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 3.6.0
+Version: 3.6.1
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -24,6 +24,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cryptography>=42
+Requires-Dist: rfc8785>=0.1.4
 Provides-Extra: sdjwt
 Provides-Extra: eval
 Requires-Dist: rfc8785>=0.1.4; extra == "eval"
@@ -40,6 +41,13 @@ Provides-Extra: formal
 Requires-Dist: z3-solver>=4.12; extra == "formal"
 Provides-Extra: pytest
 Requires-Dist: pytest>=7; extra == "pytest"
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Requires-Dist: hypothesis>=6; extra == "test"
+Requires-Dist: PyYAML>=6; extra == "test"
+Requires-Dist: jsonschema>=4; extra == "test"
+Requires-Dist: sd-jwt>=0.10; extra == "test"
+Requires-Dist: rfc8785>=0.1.4; extra == "test"
 Provides-Extra: inspect
 Requires-Dist: inspect_ai<0.4,>=0.3.112; extra == "inspect"
 Provides-Extra: dev

proofbundle-3.6.1/conformance/README.md

@@ -0,0 +1,73 @@
+# proofbundle conformance corpus
+
+Versioned, digest-pinned test vectors that a proofbundle verifier (this one, or an
+independent implementation) must agree on. Every case is verified **offline** by
+`run_conformance.py`: no calendar contact, no network — the specific Bitcoin block
+**merkle root** a case needs is frozen inside its `case.json`, independently sourced and
+byte-reproducible.
+
+Run it:
+
+```bash
+make conformance                       # skips anchor sub-checks if opentimestamps is absent
+python conformance/run_conformance.py --require-anchors   # full run (needs the [anchors] extra)
+```
+
+## Case format
+
+`manifest.json` lists case directories. Each holds a `case.json`:
+
+```
+{caseId, kind, input, expected: {...}, specRefs[], rationale, attribution}
+```
+
+`expected` is the whole point of the corpus: a case declares what it proves **and what it
+does not**. A green run therefore never overclaims — a case that is canonicalization-correct
+but not schema-conformant records the exact finding count as an *expected-fail*, it does not
+hide it.
+
+## Kinds
+
+### `decision_crossimpl`
+
+A decision-receipt statement pair (decision + referenced evidence) produced by a **second,
+independent implementation**, checked for cross-implementation agreement:
+
+- `.jcs` bytes are byte-identical with proofbundle's RFC 8785 canonical output;
+- both content roots (`statement_content_root`, jcs-sha256-v1) recompute to the `MANIFEST.json`
+  values and to `expected`;
+- `decision.evidenceRefs[*].digest` binds the evidence **content root**;
+- `validate_decision_predicate` returns exactly `expected.decision_predicate_findings` (an
+  expected-fail when the external predicate does not yet match `decision-receipt/v0.1`);
+- the OpenTimestamps anchor, when present, resolves to the expected status offline
+  (`confirmed` against a frozen merkle root, or `pending`). The verifier rejects a wrong
+  frozen root (`block_mismatch`), so confirmation is not a blind pass — that negative is
+  exercised by `tests/test_anchors_ots.py`; the corpus itself runs the positive check.
+
+### `native_bundle`
+
+A native proofbundle bundle checked against the CLI **verify exit-code contract**
+(`0` crypto OK · `1` verification failure · `2` malformed · `3` policy unmet). The exit code is
+the conformance contract, so each case declares the exact code it must produce; the fail-closed
+floor requires a `native_bundle` case to declare `exitCode`. These lock core verifier properties
+onto the gate — a valid bundle verifies, a **duplicate JSON key** is rejected as malformed (the C1
+Bishop-Fox parser-differential defense), a single flipped payload byte fails the signature.
+
+## Cases today
+
+| caseId | proves | does NOT prove |
+|---|---|---|
+| `decision-crossimpl-confirmed-anchor-lifecycle` | RFC 8785 canonicalization + content-root binding cross-impl, **and** a confirmed Bitcoin anchor at block 957504 (OTS proof committed root matches the real block merkle root, independently fetched, verified offline) | `decision-receipt/v0.1` schema conformance (predicate reports 12 findings) |
+| `decision-crossimpl-canonicalization-root-binding` | RFC 8785 canonicalization + content-root binding cross-impl | schema conformance (12 findings, expected-fail) **and** a confirmed anchor (still pending) |
+
+Both vectors are contributed by MarkovianProtocol / Colin (audit-anchor), vendored digest-pinned
+as pure data, credited. The gap between "canonicalization proven" and "full v0.1 conformance" is
+recorded in `audit_artifacts/crossimpl_fixture_gap_20260711.md`; a case graduates to a full
+end-to-end `decision-receipt/v0.1` conformance case after a schema-conformant regeneration and a
+confirmed anchor.
+
+## Adding a case
+
+Never edit an accepted vector's bytes in place — a fixture change must be a new case (or an
+explicit, reviewed re-pin), so accepted expectations cannot drift silently. Add the directory,
+its `case.json`, and a line in `manifest.json`.

proofbundle-3.6.1/conformance/bundle/coherent-rewrap-fails-expected-root/bundle.json

@@ -0,0 +1,18 @@
+{
+  "schema": "proofbundle/v0.1",
+  "payload_b64": "Y29uZm9ybWFuY2UgY29oZXJlbnQtcmV3cmFwIHZlY3RvciBwYXlsb2Fk",
+  "signature": {
+    "alg": "ed25519",
+    "public_key_b64": "uJcyYE8/ZQ5VdPb0Z2Va966zIvyWxtjg+IbJyf5lMWY=",
+    "sig_b64": "63Uo9D7tYWg/A3iUd2vixamTpkRXNb0oQYlGzPaA1KoSJWtOmcNj3MvHw0WInS0oq+ZSPWwQi3JM3Z5KBGx6DA=="
+  },
+  "merkle": {
+    "hash_alg": "sha256-rfc6962",
+    "leaf_index": 0,
+    "tree_size": 2,
+    "inclusion_proof_b64": [
+      "UmoE65hbRCJfopCqQtKC4dcIJagjPb/kxPBxBh3darw="
+    ],
+    "root_b64": "tGjjQxDAn0Pz9kRcXnLNiuGPsoq2rNOTgE8loZfOpjs="
+  }
+}

proofbundle-3.6.1/conformance/bundle/coherent-rewrap-fails-expected-root/case.json

@@ -0,0 +1,19 @@
+{
+  "caseId": "native-bundle-coherent-rewrap-fails-expected-root",
+  "kind": "native_bundle",
+  "input": "bundle.json",
+  "verifyArgs": [
+    "--expected-root",
+    "lYN6OaeW1AVBrmEIF0ZoNKdvduoh5/hQCQLBQipfBaw="
+  ],
+  "attribution": "proofbundle (P0-A / ADR 0004: relying-party root authentication)",
+  "expected": {
+    "exitCode": 1,
+    "rejected": true
+  },
+  "specRefs": [
+    "docs/adr/0004-native-root-authenticity.md",
+    "SPEC.md"
+  ],
+  "rationale": "The SAME rewrap FAILS (exit 1) when the relying party authenticates the root with the ORIGINAL single-leaf root via --expected-root: the rewrapped root does not match. Closes the coherent-rewrap; a second implementation MUST reject it too."
+}

proofbundle-3.6.1/conformance/bundle/coherent-rewrap-verifies-no-policy/bundle.json

@@ -0,0 +1,18 @@
+{
+  "schema": "proofbundle/v0.1",
+  "payload_b64": "Y29uZm9ybWFuY2UgY29oZXJlbnQtcmV3cmFwIHZlY3RvciBwYXlsb2Fk",
+  "signature": {
+    "alg": "ed25519",
+    "public_key_b64": "uJcyYE8/ZQ5VdPb0Z2Va966zIvyWxtjg+IbJyf5lMWY=",
+    "sig_b64": "63Uo9D7tYWg/A3iUd2vixamTpkRXNb0oQYlGzPaA1KoSJWtOmcNj3MvHw0WInS0oq+ZSPWwQi3JM3Z5KBGx6DA=="
+  },
+  "merkle": {
+    "hash_alg": "sha256-rfc6962",
+    "leaf_index": 0,
+    "tree_size": 2,
+    "inclusion_proof_b64": [
+      "UmoE65hbRCJfopCqQtKC4dcIJagjPb/kxPBxBh3darw="
+    ],
+    "root_b64": "tGjjQxDAn0Pz9kRcXnLNiuGPsoq2rNOTgE8loZfOpjs="
+  }
+}

proofbundle-3.6.1/conformance/bundle/coherent-rewrap-verifies-no-policy/case.json

@@ -0,0 +1,16 @@
+{
+  "caseId": "native-bundle-coherent-rewrap-verifies-no-policy",
+  "kind": "native_bundle",
+  "input": "bundle.json",
+  "attribution": "proofbundle (P0-A / ADR 0004: the SAME signed payload re-anchored under a foreign 2-leaf root)",
+  "expected": {
+    "exitCode": 0,
+    "rejected": false
+  },
+  "specRefs": [
+    "docs/adr/0004-native-root-authenticity.md",
+    "THREAT_MODEL.md",
+    "SPEC.md"
+  ],
+  "rationale": "A coherent one-leaf rewrap VERIFIES without a policy (exit 0): the native Merkle root is not in the signature input, so inclusion proves consistency under the STATED root, not its authenticity. A second implementation MUST reproduce this (root authenticity NOT_EVALUATED), so the finding is cross-checked, not just asserted in the reference."
+}

proofbundle-3.6.1/conformance/bundle/corrupted-signature/bundle.json

@@ -0,0 +1,23 @@
+{
+  "schema": "proofbundle/v0.1",
+  "payload_b64": "eyJjaTk1IjpbMC44MywwLjldLCJtZXRyaWMiOiJyZWZ1c2FsX3JhdGUiLCJwYXNzZWQiOnRydWUsInByZXJlZ19zaGEyNTYiOiJjNmQwMDdjMTM0NjU4ZTdhZGFhZGU2NmRjOTViNDQ2YTlmZThjMDU4MTA2Y2NiY2ZjNTU1Zjc0YmJlZTg2Yjc2Iiwic3VpdGUiOiJzYWZldHktcmVmdXNhbC12MSIsInRocmVzaG9sZCI6MC44fQ==",
+  "signature": {
+    "alg": "ed25519",
+    "public_key_b64": "Ts6DJw7AT4alPGqp9JVzh83VvXoMcRXVU0Lb7R2qB08=",
+    "sig_b64": "Jj5kDA1+V1vcSteIOWo7PfUgkXYetunivScPX8N291tWAd7vkhwAt+go0b6xAeRjsTr2CEp04DWtmX0HaWbgCA=="
+  },
+  "merkle": {
+    "hash_alg": "sha256-rfc6962",
+    "leaf_index": 1,
+    "tree_size": 4,
+    "inclusion_proof_b64": [
+      "WN6U3Pgo5eCqz+qM8+UyX/kkShy+ejFVDc7p26qMQME=",
+      "uHBaQJFfAr6PaU2vJE+Z5D9GK+1QTqOCof9pRIG7sp8="
+    ],
+    "root_b64": "asb7ZKCZKBiZt/SOtrKbWmqEJW++IgVLpUHv14JWNAQ="
+  },
+  "sd_jwt_vc": {
+    "compact": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRjK3NkLWp3dCJ9.eyJpc3MiOiJodHRwczovL2I3bjBkZS5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9iN24wZGUuZXhhbXBsZS9ldmFsLXJlY2VpcHQiLCJpYXQiOjE3NjAwMDAwMDAsIl9zZF9hbGciOiJzaGEtMjU2IiwiX3NkIjpbInNyNVRRd2VTQXJpa2lEc25SV2pCNGdEM2w3LTdLQ2gzM3V3RGtsSTJtNDQiLCI2QnpncWU1RUMwa1BXYkhrdjlhOUlZaEhWbDVWUWl6YjgzXzQ4SEMxM1Y4Il19.dw-6RiVvdRIUp7rDqH9CMIYNnF3ZsHkDsEWCZ78fHdH5VuCs9fVnUp5SRfM24mpBF0Iu8KQOn-iWsizAEXKVCw~WyJjMkZzZEMxdmJtVSIsInN1aXRlIiwic2FmZXR5LXJlZnVzYWwtdjEiXQ~WyJjMkZzZEMxMGQyOCIsInBhc3NlZCIsdHJ1ZV0~",
+    "issuer_public_key_b64": "bFsCX8d0AX/Pu4AjKmVcYjwiG3iPPwpNwPParhn/Cfg="
+  }
+}

proofbundle-3.6.1/conformance/bundle/corrupted-signature/case.json

@@ -0,0 +1,9 @@
+{
+  "caseId": "native-bundle-corrupted-signature",
+  "kind": "native_bundle",
+  "input": "bundle.json",
+  "attribution": "proofbundle (tamper vector: valid bundle, signature bytes corrupted, payload intact)",
+  "expected": { "exitCode": 1, "rejected": true },
+  "specRefs": ["SPEC.md", "THREAT_MODEL.md"],
+  "rationale": "A bundle whose payload is intact but whose Ed25519 signature bytes are corrupted must FAIL verification (exit 1). Distinct from tampered-payload: it proves the verifier checks the signature itself, not merely that payload and signature are mutually consistent."
+}

proofbundle-3.6.1/conformance/bundle/duplicate-json-key/bundle.json

@@ -0,0 +1,24 @@
+{
+  "schema": "DUPLICATE_INJECTED",
+  "schema": "proofbundle/v0.1",
+  "payload_b64": "eyJjaTk1IjpbMC44MywwLjldLCJtZXRyaWMiOiJyZWZ1c2FsX3JhdGUiLCJwYXNzZWQiOnRydWUsInByZXJlZ19zaGEyNTYiOiJjNmQwMDdjMTM0NjU4ZTdhZGFhZGU2NmRjOTViNDQ2YTlmZThjMDU4MTA2Y2NiY2ZjNTU1Zjc0YmJlZTg2Yjc2Iiwic3VpdGUiOiJzYWZldHktcmVmdXNhbC12MSIsInRocmVzaG9sZCI6MC44fQ==",
+  "signature": {
+    "alg": "ed25519",
+    "public_key_b64": "Ts6DJw7AT4alPGqp9JVzh83VvXoMcRXVU0Lb7R2qB08=",
+    "sig_b64": "Jj5kDA1+V1vcSteIOWo7PfUgkXYetunivScPX8N291tWjd7vkhwAt+go0b6xAeRjsTr2CEp04DWtmX0HaWbgCA=="
+  },
+  "merkle": {
+    "hash_alg": "sha256-rfc6962",
+    "leaf_index": 1,
+    "tree_size": 4,
+    "inclusion_proof_b64": [
+      "WN6U3Pgo5eCqz+qM8+UyX/kkShy+ejFVDc7p26qMQME=",
+      "uHBaQJFfAr6PaU2vJE+Z5D9GK+1QTqOCof9pRIG7sp8="
+    ],
+    "root_b64": "asb7ZKCZKBiZt/SOtrKbWmqEJW++IgVLpUHv14JWNAQ="
+  },
+  "sd_jwt_vc": {
+    "compact": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRjK3NkLWp3dCJ9.eyJpc3MiOiJodHRwczovL2I3bjBkZS5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9iN24wZGUuZXhhbXBsZS9ldmFsLXJlY2VpcHQiLCJpYXQiOjE3NjAwMDAwMDAsIl9zZF9hbGciOiJzaGEtMjU2IiwiX3NkIjpbInNyNVRRd2VTQXJpa2lEc25SV2pCNGdEM2w3LTdLQ2gzM3V3RGtsSTJtNDQiLCI2QnpncWU1RUMwa1BXYkhrdjlhOUlZaEhWbDVWUWl6YjgzXzQ4SEMxM1Y4Il19.dw-6RiVvdRIUp7rDqH9CMIYNnF3ZsHkDsEWCZ78fHdH5VuCs9fVnUp5SRfM24mpBF0Iu8KQOn-iWsizAEXKVCw~WyJjMkZzZEMxdmJtVSIsInN1aXRlIiwic2FmZXR5LXJlZnVzYWwtdjEiXQ~WyJjMkZzZEMxMGQyOCIsInBhc3NlZCIsdHJ1ZV0~",
+    "issuer_public_key_b64": "bFsCX8d0AX/Pu4AjKmVcYjwiG3iPPwpNwPParhn/Cfg="
+  }
+}

proofbundle-3.6.1/conformance/bundle/duplicate-json-key/case.json

@@ -0,0 +1,9 @@
+{
+  "caseId": "native-bundle-duplicate-json-key",
+  "kind": "native_bundle",
+  "input": "bundle.json",
+  "attribution": "proofbundle (C1 hardening vector, Bishop Fox 2021 parser differential)",
+  "expected": { "exitCode": 2, "rejected": true },
+  "specRefs": ["SPEC.md", "CHANGELOG.md"],
+  "rationale": "A bundle whose raw JSON carries a DUPLICATE top-level key must be rejected as malformed (exit 2), not silently last-wins parsed. This locks the C1 duplicate-key defense (loads_strict / object_pairs_hook) onto the conformance gate: an implementation that accepts this bundle has a parser differential and is non-conformant."
+}

proofbundle-3.6.1/conformance/bundle/forged-anchor-own-frozen/bundle.json

@@ -0,0 +1,30 @@
+{
+  "schema": "proofbundle/v0.1",
+  "payload_b64": "eyJhc3N1cmFuY2VfbGV2ZWwiOiJyZXByb2R1Y2VkIiwiY29tbWl0X2FsZyI6InNoYTI1Ni1zYWx0ZWQtdjEiLCJjb21wYXJhdG9yIjoiPj0iLCJkYXRhc2V0X2lkX2NvbW1pdCI6InNoYTI1NjowYzU5MmU3MTQ3ZjgwMWQwZmMzY2YxMTdlZjY0MGYzZDFiMzJjNjEwMjM4NzY2ZGY4NGJlYzBjZjcwNmNiNjEyIiwiaXNzdWVyIjoiZWQyNTUxOTo0YW0zNnRjRmd0YUtKL2JESXk1d0NzaTdOdnU1bDlBWlNYc053eU80Rm9zPSIsIm1ldHJpYyI6ImFjYyIsIm1vZGVsX2lkX2NvbW1pdCI6InNoYTI1Njo4MjNjNTE2YmVjYTBjYjZjNTdiMDE4YWFmNmFiNzU2OGZmZmE0YzVjMTA5Yjg5MGMzMjQ0ZDFmOGRjOTUyOTM2IiwibiI6MTAwLCJwYXNzZWQiOnRydWUsInByZXJlZ19zaGEyNTYiOiI0OWQ2NjBlYjhlMmU3ODc0YzQ4OWQ5ODFlNGM1ZDk4ZjcxZWM2YTU2MDc3YThhNGJhMWM4ZDA1ZGQxZGFmMmU4Iiwic2NoZW1hIjoicHJvb2ZidW5kbGUvZXZhbC1jbGFpbS92MC4xIiwic3VpdGUiOiJzYWZldHkiLCJzdWl0ZV92ZXJzaW9uIjoiMSIsInRocmVzaG9sZCI6IjAuOCIsInRpbWVzdGFtcCI6IjIwMjYtMDctMDlUMTA6MDA6MDBaIn0=",
+  "signature": {
+    "alg": "ed25519",
+    "public_key_b64": "4am36tcFgtaKJ/bDIy5wCsi7Nvu5l9AZSXsNwyO4Fos=",
+    "sig_b64": "xfR8hUkunmMXSf9O6BYdkybiWCJVDVKgNPUYdT/23LQZdewDNh4meAOTjKBbQ7qRpasEj7JX48YrJsEf1bEDCA=="
+  },
+  "merkle": {
+    "hash_alg": "sha256-rfc6962",
+    "leaf_index": 0,
+    "tree_size": 1,
+    "inclusion_proof_b64": [],
+    "root_b64": "BkG14oYPcAJu5NHYbORey5xN6RCF5953i92QPlt8DDg="
+  },
+  "anchors": [
+    {
+      "type": "opentimestamps",
+      "target": "preRegistration",
+      "canonicalRoot": "SdZg644ueHTEidmB5MXZj3HsalYHeopLocjQXdHa8ug=",
+      "proof": "AE9wZW5UaW1lc3RhbXBzAABQcm9vZgC/ieLohOiSlAEISdZg644ueHTEidmB5MXZj3HsalYHeopLocjQXdHa8ugABYiWDXPXGQEDgOow",
+      "anchoredAt": null,
+      "frozen": {
+        "bitcoinBlockHeaderMerkleRootsByHeight": {
+          "800000": "49d660eb8e2e7874c489d981e4c5d98f71ec6a56077a8a4ba1c8d05dd1daf2e8"
+        }
+      }
+    }
+  ]
+}

proofbundle-3.6.1/conformance/bundle/forged-anchor-own-frozen/case.json

@@ -0,0 +1,11 @@
+{
+  "caseId": "native-bundle-forged-anchor-own-frozen",
+  "kind": "native_bundle",
+  "input": "bundle.json",
+  "verifyArgs": ["--require-anchor"],
+  "requiresAnchorsExtra": true,
+  "attribution": "proofbundle (WP-A1 backdating vector: producer self-committed the Bitcoin block header into frozen)",
+  "expected": { "exitCode": 3, "rejected": true },
+  "specRefs": ["SPEC.md", "THREAT_MODEL.md"],
+  "rationale": "The receipt carries an upgraded OpenTimestamps anchor whose `frozen` block declares a self-committed Bitcoin block header (the producer put the attestation message straight into frozen so it 'looks confirmed' to a verifier that trusts frozen). WP-A1: frozen is producer-controlled evidence, never trust. With no relying-party header (no --bitcoin-header, no policy anchors.bitcoin_block_headers), the anchor is needs_rp_trust and `verify --require-anchor` is UNMET → exit 3 (a relying-party gate, distinct from a crypto failure). A malicious producer cannot self-certify a backdated timestamp. WP-A1 (Owner-GO, 2026-07-11)."
+}

proofbundle-3.6.1/conformance/bundle/n1-eval-sdjwt-graft-non-eval/bundle.json

@@ -0,0 +1,20 @@
+{
+  "schema": "proofbundle/v0.1",
+  "payload_b64": "eyJ4IjoxfQ==",
+  "signature": {
+    "alg": "ed25519",
+    "public_key_b64": "PbkdxZcmd0WLnHzZiprXM/atzNqRuLu4Wyf/e7o7o3w=",
+    "sig_b64": "GYGxYhhBsvppVm2kgvMnE3qcXmMGHqR6SyUblmgA0pclt97AvXRpVQw910LEhAxqK16cKge9f1VDdn8a7r/eCQ=="
+  },
+  "merkle": {
+    "hash_alg": "sha256-rfc6962",
+    "leaf_index": 0,
+    "tree_size": 1,
+    "inclusion_proof_b64": [],
+    "root_b64": "42s5WHp6a8Ka4Av593O2lKVCCMFT80AieH7JaR7Si6o="
+  },
+  "sd_jwt_vc": {
+    "compact": "eyJhbGciOiAiRWREU0EiLCAidHlwIjogImRjK3NkLWp3dCJ9.eyJpc3MiOiAiZWQyNTUxOTp4IiwgInZjdCI6ICJodHRwczovL2I3bjBkZS5jb20vcHJvb2ZidW5kbGUvdmN0L2V2YWwtcmVjZWlwdC92MSIsICJpYXQiOiAxNzgwMDAwMDAwLCAicmVjZWlwdCI6IHsicm9vdF9iNjQiOiAiYzI5dFpTMXZkR2hsY2kxeWIyOTAifX0.4_DKIF4oFSejQ9Tdg1r1dIRvdVPgWKbGfxunEFt6Y0MXfoXKRtFtPR7ENfnOz_exbbk9DrQziQ33CpHMyU-1BQ~",
+    "issuer_public_key_b64": "PbkdxZcmd0WLnHzZiprXM/atzNqRuLu4Wyf/e7o7o3w="
+  }
+}

proofbundle-3.6.1/conformance/bundle/n1-eval-sdjwt-graft-non-eval/case.json

@@ -0,0 +1,15 @@
+{
+  "caseId": "native-bundle-n1-eval-sdjwt-graft-non-eval",
+  "kind": "native_bundle",
+  "input": "bundle.json",
+  "attribution": "proofbundle (N1, 2026-07-13: eval SD-JWT root-commitment grafted onto a non-eval payload)",
+  "expected": {
+    "exitCode": 1,
+    "rejected": true
+  },
+  "specRefs": [
+    "SPEC.md",
+    "THREAT_MODEL.md"
+  ],
+  "rationale": "The sd_jwt_vc carries an eval-binding root commitment (receipt.root_b64) but the signed payload is NOT a proofbundle/eval-claim/v0.1 claim, so there is nothing on this bundle for that commitment to bind to. verify MUST reject it (exit 1, sd-jwt-bundle-binding=False, reason 'unbindable eval SD-JWT'). A second implementation MUST refuse this graft; keying only on eval-claim payloads leaves it vulnerable. N1."
+}

proofbundle-3.6.1/conformance/bundle/sd-jwt-forged-issuer-identity/bundle.json

@@ -0,0 +1,20 @@
+{
+  "schema": "proofbundle/v0.1",
+  "payload_b64": "eyJhc3N1cmFuY2VfbGV2ZWwiOiJyZXByb2R1Y2VkIiwiY29tbWl0X2FsZyI6InNoYTI1Ni1zYWx0ZWQtdjEiLCJjb21wYXJhdG9yIjoiPj0iLCJkYXRhc2V0X2lkX2NvbW1pdCI6InNoYTI1NjplNTg5OTM1NWNlM2YwYzJkYTg0MDBiNmVkMzY1NGYyMDdjNmMzZmEwN2QyZGE2NmYxNzhlNDBiZjUzOWI5MmVlIiwiaXNzdWVyIjoiZWQyNTUxOTpvQk4wN3NPb1VuL1QrbGd3M2EyaFlVOERuNjRmTEtrWndRTjVDeVRnQVBFPSIsIm1ldHJpYyI6ImFjYyIsIm1vZGVsX2lkX2NvbW1pdCI6InNoYTI1NjowNWMwNDAyMWJhZWMyYzQzMTUyY2NlM2M1MTkxNTEyYzI1MGE0NGU0MTQxMTM4YjQ5Mjg1N2FjMzBkNTU4MjcwIiwibiI6MTAwLCJwYXNzZWQiOnRydWUsInNjaGVtYSI6InByb29mYnVuZGxlL2V2YWwtY2xhaW0vdjAuMSIsInN1aXRlIjoic2FmZXR5Iiwic3VpdGVfdmVyc2lvbiI6IjEiLCJ0aHJlc2hvbGQiOiIwLjgiLCJ0aW1lc3RhbXAiOiIyMDI2LTA3LTA5VDEwOjAwOjAwWiJ9",
+  "signature": {
+    "alg": "ed25519",
+    "public_key_b64": "oBN07sOoUn/T+lgw3a2hYU8Dn64fLKkZwQN5CyTgAPE=",
+    "sig_b64": "yLdiCAr0SgmHWNywotmWY5gnPo6zWgOBy0HRSFbT5DwdT5mGo9vEWEe5NV2iqAgmgOhezqIM1sVdG98hyjKdAw=="
+  },
+  "merkle": {
+    "hash_alg": "sha256-rfc6962",
+    "leaf_index": 0,
+    "tree_size": 1,
+    "inclusion_proof_b64": [],
+    "root_b64": "yGkXlhJzFEbEjrcRbntElQhqdvgNYuUkXlRCQYmNmv0="
+  },
+  "sd_jwt_vc": {
+    "compact": "eyJhbGciOiAiRWREU0EiLCAidHlwIjogImRjK3NkLWp3dCJ9.eyJwYXNzZWQiOiB0cnVlLCAidGhyZXNob2xkIjogIjAuOCIsICJjb21wYXJhdG9yIjogIj49IiwgInN1aXRlIjogInNhZmV0eSIsICJpc3N1ZXIiOiAiZWQyNTUxOTpvQk4wN3NPb1VuL1QrbGd3M2EyaFlVOERuNjRmTEtrWndRTjVDeVRnQVBFPSIsICJyZWNlaXB0IjogeyJyb290X2I2NCI6ICJ5R2tYbGhKekZFYkVqcmNSYm50RWxRaHFkdmdOWXVVa1hsUkNRWW1ObXYwPSJ9LCAidmN0IjogImh0dHBzOi8vYjduMGRlLmNvbS9wcm9vZmJ1bmRsZS92Y3QvZXZhbC1yZWNlaXB0L3YxIiwgImNuZiI6IHsiandrIjogeyJrdHkiOiAiT0tQIiwgImNydiI6ICJFZDI1NTE5IiwgIngiOiAiYm4zMXIyRWNtOUg5MDNVRHpGdE0ycVk1aV9Tc0ktUnRFVU1VOG8yby05ZyJ9fSwgIl9zZCI6IFsiVHBFbV9BZEdxLTVsbUlMV0FwZTdTaGt4WkppRkszWWh5S19aX2JLNlBsMCJdLCAiX3NkX2FsZyI6ICJzaGEtMjU2In0.f-4SOL__nt9STB3Lto-UPMWbZ7jwF-H6s2lO6-5RxAC31T0MOSboxdUhcVhe8CSnEjJuLVc7hCj48k31RpefCw~WyJZTU92cTBIWmszaHZMUW5TVmlNOEVnIiwgImV4YWN0X3Njb3JlIiwgIjAuOTk5OTkiXQ~eyJhbGciOiAiRWREU0EiLCAidHlwIjogImtiK2p3dCJ9.eyJpYXQiOiAxNzgwMDAwMDAwLCAiYXVkIjogInYiLCAibm9uY2UiOiAibiIsICJzZF9oYXNoIjogIjR0emYxdHJEOGVuYjlVRkZ3NHpORG1mYVY3TUM5TWlxWk50aVFRTVp1aHcifQ.4Mmf9QjLQCMAKoGaAj3L80_u4h2ThgpsffHY-TYinN28TSfzl_1xzy4YK_btQu8-Z31E2AalJBezXmL_4-ooBg",
+    "issuer_public_key_b64": "fDmw+YPWJYZX57INJJHIbZhbcgdLkNTFlaVoiWIBe+4="
+  }
+}

proofbundle-3.6.1/conformance/bundle/sd-jwt-forged-issuer-identity/case.json

@@ -0,0 +1,9 @@
+{
+  "caseId": "native-bundle-sd-jwt-forged-issuer-identity",
+  "kind": "native_bundle",
+  "input": "bundle.json",
+  "attribution": "proofbundle (WP-C1 forged-identity vector: valid issuer signature by the WRONG signer)",
+  "expected": { "exitCode": 1, "rejected": true },
+  "specRefs": ["SPEC.md", "THREAT_MODEL.md"],
+  "rationale": "The sd_jwt_vc has a cryptographically VALID issuer signature and binds the correct merkle root, but the signing key is the attacker's own — while the always-open `issuer` claim names the trusted bundle issuer (and a forged exact_score is disclosed). Only the sd-jwt-issuer-identity check (fingerprint(issuer_public_key_b64) == disclosed issuer) catches it: a valid signature by the wrong signer is a forged identity, not evidence. verify MUST reject (exit 1, sd-jwt-issuer-signature=True but sd-jwt-issuer-identity=False, reason issuer-key-mismatch). WP-C1 (Owner-GO, 2026-07-11)."
+}

proofbundle-3.6.1/conformance/bundle/sd-jwt-signed-but-unbound/bundle.json

@@ -0,0 +1,20 @@
+{
+  "schema": "proofbundle/v0.1",
+  "payload_b64": "eyJhc3N1cmFuY2VfbGV2ZWwiOiJyZXByb2R1Y2VkIiwiY29tbWl0X2FsZyI6InNoYTI1Ni1zYWx0ZWQtdjEiLCJjb21wYXJhdG9yIjoiPj0iLCJkYXRhc2V0X2lkX2NvbW1pdCI6InNoYTI1NjplODhjYTI3MmZiYmQ5OGZkMzFhZWM1NTdmNGJlZmYzYmQwYWQ0YzM0MTIwN2ZhYmMyNjVjYmFmN2VhMjMzMTM5IiwiaXNzdWVyIjoiZWQyNTUxOTpxSDQwZkNnRGhTajNMSWlDc3ZBZ1IwRXFuQ0pvN0Vra1lVZkhsT1ZhMnBFPSIsIm1ldHJpYyI6ImFjYyIsIm1vZGVsX2lkX2NvbW1pdCI6InNoYTI1NjpmMWJhNGM3NTVhNmY2MWQ4ZjdmMTc2OGQyMWU4M2I4MGRmNjdlNWU0NmNiNTgxZjEyYmFjYjZiZDg1MWY3NWI1IiwibiI6MTAwLCJwYXNzZWQiOnRydWUsInNjaGVtYSI6InByb29mYnVuZGxlL2V2YWwtY2xhaW0vdjAuMSIsInN1aXRlIjoic2FmZXR5Iiwic3VpdGVfdmVyc2lvbiI6IjEiLCJ0aHJlc2hvbGQiOiIwLjgiLCJ0aW1lc3RhbXAiOiIyMDI2LTA3LTA5VDEwOjAwOjAwWiJ9",
+  "signature": {
+    "alg": "ed25519",
+    "public_key_b64": "qH40fCgDhSj3LIiCsvAgR0EqnCJo7EkkYUfHlOVa2pE=",
+    "sig_b64": "C6IPjcfGneXkykQuc/Od6ubUNwu4J/YxI0y/2/vKZnmKe87kmzWU9HkYsydrV9uCEwlCuDn8gvukokxG0xvVAA=="
+  },
+  "merkle": {
+    "hash_alg": "sha256-rfc6962",
+    "leaf_index": 0,
+    "tree_size": 1,
+    "inclusion_proof_b64": [],
+    "root_b64": "2NkvDoevRRj0U/FQxSH3NK/7rbDcBecI/7Y1sDpCwAk="
+  },
+  "sd_jwt_vc": {
+    "compact": "eyJhbGciOiAiRWREU0EiLCAidHlwIjogImRjK3NkLWp3dCJ9.eyJwYXNzZWQiOiB0cnVlLCAidGhyZXNob2xkIjogIjAuOCIsICJjb21wYXJhdG9yIjogIj49IiwgInN1aXRlIjogInNhZmV0eSIsICJpc3N1ZXIiOiAiZWQyNTUxOTpxSDQwZkNnRGhTajNMSWlDc3ZBZ1IwRXFuQ0pvN0Vra1lVZkhsT1ZhMnBFPSIsICJyZWNlaXB0IjogeyJyb290X2I2NCI6ICJkM0p2Ym1jPSJ9LCAidmN0IjogImh0dHBzOi8vYjduMGRlLmNvbS9wcm9vZmJ1bmRsZS92Y3QvZXZhbC1yZWNlaXB0L3YxIiwgImNuZiI6IHsiandrIjogeyJrdHkiOiAiT0tQIiwgImNydiI6ICJFZDI1NTE5IiwgIngiOiAiVDZLcGNuUGtsZ3o3V2NfMjZxb2lWczZTendBZ3lEM2tVd0FGVDFtNWFCTSJ9fSwgIl9zZCI6IFsiaU96RTBPYnpKcTE1dC1tMDB4Z1hxaXdxWTdlV29saF8tcW85UkNndW0yUSJdLCAiX3NkX2FsZyI6ICJzaGEtMjU2In0.6ZP5QRtQ6_4jHYHOCiYWtuh3l619K-gptyW2FeQ0nwZAQnFcjSq0kSzj4kh8itOyLwP_Iy9tqj52sraSrjslBw~WyJlQ1pqMlV4NGUzblZuTXVSWW11NWtBIiwgImV4YWN0X3Njb3JlIiwgIjAuOSJd~eyJhbGciOiAiRWREU0EiLCAidHlwIjogImtiK2p3dCJ9.eyJpYXQiOiAxNzgwMDAwMDAwLCAiYXVkIjogInZlcmlmaWVyLmV4YW1wbGUiLCAibm9uY2UiOiAibi0yIiwgInNkX2hhc2giOiAiX0s1dDNQcWRVNmd6bWFSdngwVU1Vajh2NXhZTExSeXhOVEJxU1hSMGM1WSJ9.6u1Ixzs4n5ALIA-aXgdjePfHhQ-wpqhqrym41QqNnORAkitVu0rGkabbO3ZoNKMNeqFMhhOZ6KwnnPHLAjv4CQ",
+    "issuer_public_key_b64": "qH40fCgDhSj3LIiCsvAgR0EqnCJo7EkkYUfHlOVa2pE="
+  }
+}

proofbundle-3.6.1/conformance/bundle/sd-jwt-signed-but-unbound/case.json

@@ -0,0 +1,9 @@
+{
+  "caseId": "native-bundle-sd-jwt-signed-but-unbound",
+  "kind": "native_bundle",
+  "input": "bundle.json",
+  "attribution": "proofbundle (WP-C1 cross-receipt-substitution vector: valid issuer signature over disclosures that bind a DIFFERENT bundle)",
+  "expected": { "exitCode": 1, "rejected": true },
+  "specRefs": ["SPEC.md", "THREAT_MODEL.md"],
+  "rationale": "The sd_jwt_vc has a VALID issuer signature, but its always-open disclosures commit a merkle root that does not match THIS bundle's root — a receipt lifted from another bundle and grafted on. verify MUST reject it (exit 1, sd-jwt-bundle-binding=False, reason unbound/mismatch): a genuine issuer signature over the wrong bundle is not evidence for this one. WP-C1 (Owner-GO breaking, 2026-07-11)."
+}

proofbundle-3.6.1/conformance/bundle/sd-jwt-unsigned-unauthenticated/bundle.json

@@ -0,0 +1,19 @@
+{
+  "schema": "proofbundle/v0.1",
+  "payload_b64": "eyJ4IjoxfQ==",
+  "signature": {
+    "alg": "ed25519",
+    "public_key_b64": "Aqwx1GmWNnmXzz1nCOQNswnmi7KoPoxTYHpWO/onklU=",
+    "sig_b64": "QlIi4MlJA9yPJ09g2akZPEq/YZWWNAQWGBVMRMZTAntpvGugFT9EzYbG8nc5XlpBlZi0iZOOdwELSgZ+p7sjAA=="
+  },
+  "merkle": {
+    "hash_alg": "sha256-rfc6962",
+    "leaf_index": 0,
+    "tree_size": 1,
+    "inclusion_proof_b64": [],
+    "root_b64": "42s5WHp6a8Ka4Av593O2lKVCCMFT80AieH7JaR7Si6o="
+  },
+  "sd_jwt_vc": {
+    "compact": "eyJhbGciOiAiRWREU0EiLCAidHlwIjogImRjK3NkLWp3dCJ9.eyJwYXNzZWQiOiB0cnVlLCAidGhyZXNob2xkIjogIjAuODAiLCAiY29tcGFyYXRvciI6ICI-PSIsICJzdWl0ZSI6ICJkZW1vLXN1aXRlIiwgImlzc3VlciI6ICJlZDI1NTE5OkFxd3gxR21XTm5tWHp6MW5DT1FOc3dubWk3S29Qb3hUWUhwV08vb25rbFU9IiwgInJlY2VpcHQiOiB7InJvb3RfYjY0IjogImNtOXZkQT09In0sICJ2Y3QiOiAiaHR0cHM6Ly9iN24wZGUuY29tL3Byb29mYnVuZGxlL3ZjdC9ldmFsLXJlY2VpcHQvdjEiLCAiX3NkIjogWyJCWnVMUW9NZkgxeWNEMzdzRGVaVW81OERGR2NzazZBU0lrNmxKQnRwbXJNIl0sICJfc2RfYWxnIjogInNoYS0yNTYifQ.GkxmfInFX-NvL-JhU-VbNefIRtCYtlkEmeYCDWStLoTMUK3HLyN74zGW8BFnDKJ7wfTQ80AS_nEAmIwfvkWoDQ~WyJhOEVGR2tfSm9vSlBNbmUydHJacE53IiwgImV4YWN0X3Njb3JlIiwgIjAuOTIiXQ~"
+  }
+}

proofbundle-3.6.1/conformance/bundle/sd-jwt-unsigned-unauthenticated/case.json

@@ -0,0 +1,9 @@
+{
+  "caseId": "native-bundle-sd-jwt-unsigned-unauthenticated",
+  "kind": "native_bundle",
+  "input": "bundle.json",
+  "attribution": "proofbundle (WP-C2 secure-by-default vector: sd_jwt_vc present with NO issuer_public_key_b64; cnf-free so the failure isolates WP-C2)",
+  "expected": { "exitCode": 1, "rejected": true },
+  "specRefs": ["SPEC.md", "THREAT_MODEL.md"],
+  "rationale": "An sd_jwt_vc lives OUTSIDE payload_b64, so the bundle's Ed25519 signature does NOT cover it — only the issuer signature authenticates its disclosures. A bundle that carries an SD-JWT but supplies no issuer_public_key_b64 leaves those disclosures unauthenticated and MUST fail verification (exit 1), not pass with a warning. WP-C2 (Owner-GO breaking / secure-by-default, 2026-07-11): this replaced the prior null-and-warn behaviour. The SD-JWT deliberately carries NO cnf holder key (release-audit F14, 2026-07-12): a cnf would make the older v1.6 cnf-without-issuer-key fail-closed check ALSO reject the bundle, masking whether WP-C2 itself fires — cnf-free, disabling the WP-C2 defense flips this vector to exit 0, so it genuinely isolates and proves WP-C2."
+}

proofbundle-3.6.1/conformance/bundle/tampered-payload/bundle.json

@@ -0,0 +1,23 @@
+{
+  "schema": "proofbundle/v0.1",
+  "payload_b64": "eyJjaTk1IjpbMC44MywwLjldLCJtZXRyaWMiOiJyZWZ1c2FsX3JhdGUiLCJwYXNzZWQiOnRydWUsInByZXJlZ19zaGEyNTYiOiJjNmQwMDdjMTM0NjU4ZTdhZGFhAGU2NmRjOTViNDQ2YTlmZThjMDU4MTA2Y2NiY2ZjNTU1Zjc0YmJlZTg2Yjc2Iiwic3VpdGUiOiJzYWZldHktcmVmdXNhbC12MSIsInRocmVzaG9sZCI6MC44fQ==",
+  "signature": {
+    "alg": "ed25519",
+    "public_key_b64": "Ts6DJw7AT4alPGqp9JVzh83VvXoMcRXVU0Lb7R2qB08=",
+    "sig_b64": "Jj5kDA1+V1vcSteIOWo7PfUgkXYetunivScPX8N291tWjd7vkhwAt+go0b6xAeRjsTr2CEp04DWtmX0HaWbgCA=="
+  },
+  "merkle": {
+    "hash_alg": "sha256-rfc6962",
+    "leaf_index": 1,
+    "tree_size": 4,
+    "inclusion_proof_b64": [
+      "WN6U3Pgo5eCqz+qM8+UyX/kkShy+ejFVDc7p26qMQME=",
+      "uHBaQJFfAr6PaU2vJE+Z5D9GK+1QTqOCof9pRIG7sp8="
+    ],
+    "root_b64": "asb7ZKCZKBiZt/SOtrKbWmqEJW++IgVLpUHv14JWNAQ="
+  },
+  "sd_jwt_vc": {
+    "compact": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRjK3NkLWp3dCJ9.eyJpc3MiOiJodHRwczovL2I3bjBkZS5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9iN24wZGUuZXhhbXBsZS9ldmFsLXJlY2VpcHQiLCJpYXQiOjE3NjAwMDAwMDAsIl9zZF9hbGciOiJzaGEtMjU2IiwiX3NkIjpbInNyNVRRd2VTQXJpa2lEc25SV2pCNGdEM2w3LTdLQ2gzM3V3RGtsSTJtNDQiLCI2QnpncWU1RUMwa1BXYkhrdjlhOUlZaEhWbDVWUWl6YjgzXzQ4SEMxM1Y4Il19.dw-6RiVvdRIUp7rDqH9CMIYNnF3ZsHkDsEWCZ78fHdH5VuCs9fVnUp5SRfM24mpBF0Iu8KQOn-iWsizAEXKVCw~WyJjMkZzZEMxdmJtVSIsInN1aXRlIiwic2FmZXR5LXJlZnVzYWwtdjEiXQ~WyJjMkZzZEMxMGQyOCIsInBhc3NlZCIsdHJ1ZV0~",
+    "issuer_public_key_b64": "bFsCX8d0AX/Pu4AjKmVcYjwiG3iPPwpNwPParhn/Cfg="
+  }
+}

proofbundle-3.6.1/conformance/bundle/tampered-payload/case.json

@@ -0,0 +1,9 @@
+{
+  "caseId": "native-bundle-tampered-payload",
+  "kind": "native_bundle",
+  "input": "bundle.json",
+  "attribution": "proofbundle (tamper vector: valid bundle with one payload byte flipped)",
+  "expected": { "exitCode": 1, "rejected": true },
+  "specRefs": ["SPEC.md", "THREAT_MODEL.md"],
+  "rationale": "A valid bundle with a single payload byte changed must FAIL verification (exit 1): the Ed25519 signature no longer matches. Proves the signature actually binds the payload, not just that it parses."
+}

proofbundle-3.6.1/conformance/bundle/tree-size-expectation-mismatch/bundle.json

@@ -0,0 +1,16 @@
+{
+  "schema": "proofbundle/v0.1",
+  "payload_b64": "Y29uZm9ybWFuY2UgdHJlZS1zaXplIHZlY3Rvcg==",
+  "signature": {
+    "alg": "ed25519",
+    "public_key_b64": "cc170Rq7V3ATWBTvgoljlExH6f8paz3WLFNB1v+MmgI=",
+    "sig_b64": "hOWyKoiRB2OyC9gxV/XrMJ4fXkdH73RDe1+pXSzv10vn6bCPX8dydjoq33Aqa7hpKBnjXq1w9BNVVzNADgFeBQ=="
+  },
+  "merkle": {
+    "hash_alg": "sha256-rfc6962",
+    "leaf_index": 0,
+    "tree_size": 1,
+    "inclusion_proof_b64": [],
+    "root_b64": "3IfxnRnme6AXi4UvsfWPZEkhZ791D6Q9ilLaxqxVHTI="
+  }
+}

proofbundle-3.6.1/conformance/bundle/tree-size-expectation-mismatch/case.json

@@ -0,0 +1,18 @@
+{
+  "caseId": "native-bundle-tree-size-expectation-mismatch",
+  "kind": "native_bundle",
+  "input": "bundle.json",
+  "verifyArgs": [
+    "--expected-tree-size",
+    "999"
+  ],
+  "attribution": "proofbundle (AP-3, 2026-07-13: expected-tree-size checked INDEPENDENTLY of the root)",
+  "expected": {
+    "exitCode": 1,
+    "rejected": true
+  },
+  "specRefs": [
+    "SPEC.md"
+  ],
+  "rationale": "A single-leaf receipt has merkle.tree_size 1; a relying party asserting --expected-tree-size 999 gets exit 1 (tree-size FAIL) with NO --expected-root supplied \u2014 proving the tree-size gate runs independently of root authentication. treeSizeExpectation.status=FAIL. A second implementation MUST reject the mismatch."
+}

proofbundle-3.6.1/conformance/bundle/valid-minimal/bundle.json

@@ -0,0 +1,23 @@
+{
+  "schema": "proofbundle/v0.1",
+  "payload_b64": "eyJjaTk1IjpbMC44MywwLjldLCJtZXRyaWMiOiJyZWZ1c2FsX3JhdGUiLCJwYXNzZWQiOnRydWUsInByZXJlZ19zaGEyNTYiOiJjNmQwMDdjMTM0NjU4ZTdhZGFhZGU2NmRjOTViNDQ2YTlmZThjMDU4MTA2Y2NiY2ZjNTU1Zjc0YmJlZTg2Yjc2Iiwic3VpdGUiOiJzYWZldHktcmVmdXNhbC12MSIsInRocmVzaG9sZCI6MC44fQ==",
+  "signature": {
+    "alg": "ed25519",
+    "public_key_b64": "Ts6DJw7AT4alPGqp9JVzh83VvXoMcRXVU0Lb7R2qB08=",
+    "sig_b64": "Jj5kDA1+V1vcSteIOWo7PfUgkXYetunivScPX8N291tWjd7vkhwAt+go0b6xAeRjsTr2CEp04DWtmX0HaWbgCA=="
+  },
+  "merkle": {
+    "hash_alg": "sha256-rfc6962",
+    "leaf_index": 1,
+    "tree_size": 4,
+    "inclusion_proof_b64": [
+      "WN6U3Pgo5eCqz+qM8+UyX/kkShy+ejFVDc7p26qMQME=",
+      "uHBaQJFfAr6PaU2vJE+Z5D9GK+1QTqOCof9pRIG7sp8="
+    ],
+    "root_b64": "asb7ZKCZKBiZt/SOtrKbWmqEJW++IgVLpUHv14JWNAQ="
+  },
+  "sd_jwt_vc": {
+    "compact": "eyJhbGciOiJFZERTQSIsInR5cCI6ImRjK3NkLWp3dCJ9.eyJpc3MiOiJodHRwczovL2I3bjBkZS5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9iN24wZGUuZXhhbXBsZS9ldmFsLXJlY2VpcHQiLCJpYXQiOjE3NjAwMDAwMDAsIl9zZF9hbGciOiJzaGEtMjU2IiwiX3NkIjpbInNyNVRRd2VTQXJpa2lEc25SV2pCNGdEM2w3LTdLQ2gzM3V3RGtsSTJtNDQiLCI2QnpncWU1RUMwa1BXYkhrdjlhOUlZaEhWbDVWUWl6YjgzXzQ4SEMxM1Y4Il19.dw-6RiVvdRIUp7rDqH9CMIYNnF3ZsHkDsEWCZ78fHdH5VuCs9fVnUp5SRfM24mpBF0Iu8KQOn-iWsizAEXKVCw~WyJjMkZzZEMxdmJtVSIsInN1aXRlIiwic2FmZXR5LXJlZnVzYWwtdjEiXQ~WyJjMkZzZEMxMGQyOCIsInBhc3NlZCIsdHJ1ZV0~",
+    "issuer_public_key_b64": "bFsCX8d0AX/Pu4AjKmVcYjwiG3iPPwpNwPParhn/Cfg="
+  }
+}

proofbundle-3.6.1/conformance/bundle/valid-minimal/case.json

@@ -0,0 +1,9 @@
+{
+  "caseId": "native-bundle-valid-minimal",
+  "kind": "native_bundle",
+  "input": "bundle.json",
+  "attribution": "proofbundle (examples/example_bundle.json)",
+  "expected": { "exitCode": 0, "rejected": false },
+  "specRefs": ["SPEC.md", "README.md"],
+  "rationale": "A valid signed bundle verifies (exit 0). The positive anchor of the native-bundle conformance set; any implementation must accept it."
+}